CREWPIX

Privacy Policy for the App

Last updated: 27 October 2026 (trip planner, cost splitter, travel map and personal view added) · Deutsch

In short

CREWPIX is a shared travel photo album for groups. So that you can share photos, we store your photos, videos and album data on our own server in Germany. Albums are always private: only the people you invite can see them. There are no ads, no analytics or tracking tools, and we never sell data.

What we store

• Account: email address, display name, password (stored only as an encrypted hash, never in plain text). If you sign in with Apple, we store the identifier Apple provides and, if shared, your (possibly anonymised) email address.
• Albums: title, description, travel dates, members and the invite code.
• Photos and videos: photos and videos are stored without embedded metadata (e.g. EXIF, GPS) – also in original quality. Photos are re-saved on your device for this; for videos, the server removes the metadata when saving. We also store the capture time and – only if the “Share location” switch is on – the capture location as a separate field, so the album can be sorted by day and shown on a map. All album members can see the location. You can turn off “Share location” in the settings.
• Album content: captions, comments, likes, daily notes and sections within a travel day (time and text), plus the chosen cover photo and crop. Our server calculates a colour from each photo in which the album is shown – no other service is involved.
• Personal view: which photos you have hidden just for yourself. Only you can see this.
• Trip planner: bookings in the album (type such as flight, train, hotel, restaurant, rental car or activity; title, start and end, place/address, booking number, price and currency, note, who booked and who created the entry), plus attached receipts (photos, screenshots or PDFs of booking confirmations). These may contain names, addresses and booking details – please only upload what the group may see.
• Cost splitter: expenses in the album (description, amount, currency, date, who paid, for whom and how it is split). The app calculates who owes whom. An expense can be linked to a booking. No payments are made in the app; no payment service is connected.
• Notifications: if you allow push notifications, we store your device's push token, the platform (iOS/Android) and the app language.
• Reports: if you report a photo or comment, we store the report so we can review and, if needed, remove the content.

Photos on your device: so CREWPIX can suggest photos from the trip period, the app accesses your photo library – only with your permission. The selection happens on your device; only what you choose is uploaded.

Personal documents (e.g. a photo of your passport) stay on your device only. They are never sent to our server and never shared with the group; we have no access to them. They are opened with Face ID or your device passcode – the app only receives the answer "recognised" or "not recognised", never biometric data. Please note: the documents are part of your normal device backup (e.g. iCloud), like other app data.

Place names on the travel map: if photos have a capture location, the app draws a travel map. To get the place names, your phone asks the operating system's place service (iPhone: Apple, Android: Google) – only a point rounded to about 1 km is sent. The place names are stored on your device only, not on our server. The app never asks for your own location.

File picker: to attach PDFs as receipts, the app opens your device's file picker. Only the file you select is uploaded.

Purpose and legal basis

We use this data only to provide the app to you: account, shared albums, trip planner, cost splitter, notifications and export (Art. 6(1)(b) GDPR – contract). We handle reports to prevent abuse (Art. 6(1)(f) GDPR – legitimate interest). Push notifications and access to your photo library and location are used only with your consent, which you can withdraw at any time in your device settings (Art. 6(1)(a) GDPR).

Who can see your data

Album content – including bookings, receipts and expenses – is visible only to the album's members. Every member can export photos from the album (PDF photo book or ZIP). Exports are generated on request and sent directly; nothing of them is stored on the server.

Server and service providers

• Hetzner Online GmbH (data centre in Nuremberg, Germany) runs our server under a data processing agreement. The server keeps only short technical logs without IP addresses, deleted after 3 days.
• Apple – for Sign in with Apple, push notifications on iPhone (Apple Push Notification service), the map (Apple Maps) and the place names of the travel map. Apple's privacy policy applies.
• Expo (650 Industries, Inc., USA) – forwards push notifications to Apple or Google. Expo receives the push token and the short notification text (e.g. "Anna added 12 photos", without album title or comment text). Expo is certified under the EU-U.S. Data Privacy Framework; transfers to the USA rely on the European Commission's adequacy decision for it (Art. 45 GDPR).
• Brevo (Sendinblue SAS, France) – sends emails to confirm your address and to reset your password, and receives your email address for this purpose, under a data processing agreement.
• Android only: Google (Firebase Cloud Messaging for push notifications, Google Maps for the map, place names of the travel map). Google's privacy policy applies.

How long we keep data

Your data is kept as long as your account exists. If you delete a photo, comment or album, it is removed from the server. Only the person who uploaded a photo can delete it; everyone else can hide it for themselves or report it. If you delete your account (in the app under Settings), all your data is deleted immediately: your account, all albums you created – with all photos in them, including those of other members –, your photos, comments, likes, bookings, receipts and expenses in other albums, your reports and your push devices. Your name is removed from other members' expenses and bookings (the expense is then split among the remaining people). Other members who want to keep their photos should export them first.

Contact by email

If you write to us, we use your email address and message only to reply, and delete them once the request is resolved and no legal retention obligations apply.

Controller

Email: support@mindmaniax.de

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. Just send us an email.

The privacy policy for all Mindmaniax services is here, the legal notice here.